Client authentication configuration in Kafka - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to set the SASL mechanism to use SCRAM-SHA-256.

Kafka

sasl.mechanism=[1]

Drag options to blanks, or click blank then click option'

AOAUTHBEARER

BPLAIN

CGSSAPI

DSCRAM-SHA-256

Attempts:

3 left

💡 Hint

Common Mistakes

Using a mechanism not supported by the Kafka broker.

Misspelling the mechanism name.

The SASL mechanism SCRAM-SHA-256 is used for secure client authentication.

2fill in blank

medium

Complete the code to specify the security protocol for client authentication.

Kafka

security.protocol=[1]

Drag options to blanks, or click blank then click option'

ASSL

BPLAINTEXT

CSASL_SSL

DSASL_PLAINTEXT

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing PLAINTEXT which does not encrypt data.

Using SSL without SASL when authentication is needed.

The SASL_SSL protocol combines SASL authentication with SSL encryption for secure communication.

3fill in blank

hard

Fix the error in the JAAS configuration string for SCRAM authentication.

Kafka

sasl.jaas.config="org.apache.kafka.common.security.scram.ScramLoginModule required [1]=\"secret\" password=\"secret\";"

Drag options to blanks, or click blank then click option'

Auser

Busername

Cclient

Dlogin

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'user' instead of 'username' causes authentication failure.

Incorrect escaping of quotes in the string.

The JAAS config requires the keyword username to specify the username for SCRAM authentication.

4fill in blank

hard

Fill both blanks to configure the client to use SSL truststore and keystore.

Kafka

ssl.truststore.location=[1]
ssl.keystore.location=[2]

Drag options to blanks, or click blank then click option'

A/etc/kafka/client.truststore.jks

B/etc/kafka/client.keystore.jks

C/var/lib/kafka/keystore.jks

D/var/lib/kafka/truststore.jks

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up truststore and keystore file paths.

Using incorrect file paths that do not exist.

The truststore and keystore locations must point to the correct files for SSL authentication.

5fill in blank

hard

Fill all three blanks to complete the SASL SCRAM client configuration.

Kafka

sasl.mechanism=[1]
sasl.jaas.config="org.apache.kafka.common.security.scram.ScramLoginModule required username=\"[2]\" password=\"[3]\";"

Drag options to blanks, or click blank then click option'

ASCRAM-SHA-512

Balice

Calice_password

DSCRAM-SHA-256

Attempts:

3 left

💡 Hint

Common Mistakes

Using mismatched SASL mechanism and JAAS module.

Incorrectly escaping quotes in the JAAS config string.

This configuration sets the SASL mechanism to SCRAM-SHA-256 with username alice and her password.

Practice

1. What is the main purpose of client authentication in Kafka?

easy

A. To verify the identity of clients connecting to the Kafka broker

B. To increase the speed of message delivery

C. To compress messages before sending

D. To store messages permanently on the client side

Solution

1. Step 1: Understand client authentication

   Client authentication is about confirming who is connecting to Kafka to ensure security.

2. Step 2: Identify the purpose in Kafka context

   Kafka uses client authentication to verify client identity before allowing access.

3. Final Answer:

   To verify the identity of clients connecting to the Kafka broker -> Option A

4. Quick Check:

   Client authentication = verify identity [OK]

Hint: Authentication means verifying who you are [OK]

Common Mistakes:

• Confusing authentication with message compression
• Thinking authentication speeds up delivery
• Mixing authentication with data storage

2. Which Kafka client configuration property is used to enable SSL authentication?

easy

A. enable.ssl.auth=true

B. ssl.enabled=true

C. security.protocol=SSL

D. auth.method=ssl

Solution

1. Step 1: Recall Kafka SSL config property

   The correct property to enable SSL is 'security.protocol' set to 'SSL'.

2. Step 2: Check other options for correctness

   Other options are not valid Kafka config keys for SSL authentication.

3. Final Answer:

   security.protocol=SSL -> Option C

4. Quick Check:

   SSL enabled by security.protocol=SSL [OK]

Hint: Use security.protocol=SSL to enable SSL [OK]

Common Mistakes:

• Using non-existent properties like ssl.enabled
• Confusing property names with auth.method
• Adding extra words like enable.ssl.auth

3. Given this Kafka client config snippet:

security.protocol=SASL_SSL
sasl.mechanism=PLAIN
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="user" password="pass";

What type of client authentication is configured?

medium

A. SSL without SASL

B. SASL with PLAIN mechanism over SSL

C. SASL with SCRAM mechanism

D. No authentication

Solution

1. Step 1: Analyze security.protocol and sasl.mechanism

   security.protocol=SASL_SSL means SASL authentication over SSL. sasl.mechanism=PLAIN means using PLAIN SASL mechanism.

2. Step 2: Confirm authentication type

   The config uses SASL PLAIN mechanism secured by SSL transport.

3. Final Answer:

   SASL with PLAIN mechanism over SSL -> Option B

4. Quick Check:

   SASL_SSL + PLAIN = SASL PLAIN over SSL [OK]

Hint: SASL_SSL means SASL over SSL, check sasl.mechanism [OK]

Common Mistakes:

• Ignoring sasl.mechanism and assuming only SSL
• Confusing PLAIN with SCRAM mechanism
• Thinking no authentication is set

4. You have this Kafka client config:

security.protocol=SSL
ssl.keystore.location=/path/to/keystore
ssl.keystore.password=wrongpass

The client fails to authenticate. What is the most likely cause?

medium

A. Incorrect keystore password

B. Missing sasl.mechanism property

C. security.protocol should be PLAINTEXT

D. ssl.keystore.location path is not needed

Solution

1. Step 1: Check SSL keystore config

   The keystore password is set to 'wrongpass', which likely does not match the actual password.

2. Step 2: Evaluate other options

   Missing sasl.mechanism is irrelevant for SSL-only config. PLAINTEXT disables security. Keystore location is required.

3. Final Answer:

   Incorrect keystore password -> Option A

4. Quick Check:

   Wrong password causes SSL auth failure [OK]

Hint: Check passwords carefully for SSL keystore [OK]

Common Mistakes:

• Assuming sasl.mechanism is needed for SSL-only
• Changing security.protocol to PLAINTEXT by mistake
• Ignoring keystore location requirement

5. You want to configure a Kafka client to authenticate using SASL SCRAM-SHA-512 over SSL. Which configuration snippet is correct?

hard

A. security.protocol=SASL_SSL
sasl.mechanism=PLAIN
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="user" password="pass";

B. security.protocol=SSL
sasl.mechanism=SCRAM-SHA-512
sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="user" password="pass";

C. security.protocol=SASL_PLAINTEXT
sasl.mechanism=SCRAM-SHA-512
sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="user" password="pass";

D. security.protocol=SASL_SSL
sasl.mechanism=SCRAM-SHA-512
sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="user" password="pass";

Solution

1. Step 1: Identify correct security.protocol for SASL SCRAM over SSL

   It must be 'SASL_SSL' to use SASL authentication over SSL.

2. Step 2: Match sasl.mechanism and jaas config

   For SCRAM-SHA-512, sasl.mechanism must be 'SCRAM-SHA-512' and jaas config must use ScramLoginModule.

3. Step 3: Verify options

   security.protocol=SASL_SSL sasl.mechanism=SCRAM-SHA-512 sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="user" password="pass"; matches all requirements. security.protocol=SSL sasl.mechanism=SCRAM-SHA-512 sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="user" password="pass"; misses SASL in protocol. security.protocol=SASL_PLAINTEXT sasl.mechanism=SCRAM-SHA-512 sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="user" password="pass"; uses PLAINTEXT transport. security.protocol=SASL_SSL sasl.mechanism=PLAIN sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="user" password="pass"; uses PLAIN mechanism, not SCRAM.

4. Final Answer:

   security.protocol=SASL_SSL sasl.mechanism=SCRAM-SHA-512 sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="user" password="pass"; -> Option D

5. Quick Check:

   SASL_SSL + SCRAM-SHA-512 + ScramLoginModule = security.protocol=SASL_SSL sasl.mechanism=SCRAM-SHA-512 sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="user" password="pass"; [OK]

Hint: Use SASL_SSL with matching SCRAM mechanism and login module [OK]

Common Mistakes:

• Using SSL without SASL for SCRAM
• Mixing PLAIN mechanism with SCRAM config
• Setting security.protocol to PLAINTEXT